# CVE-2026-41053: SUSE Rancher privilege escalation in GitHub App authentication provider

Source: https://junglewise.ai/threats/cve-2026-41053-suse-rancher-privilege-escalation-in-github-app-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-30. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-41053 · Severity: high · CVSS 8.8 · Published 2026-06-30

A security flaw in Rancher Manager's GitHub App authentication provider allows users to inherit permissions they were never granted. If a user belongs to just one team within a GitHub organization, Rancher may mistakenly grant them the access rights of every other team in that same organization. This could allow a low-privileged user to gain administrative control over clusters or access sensitive project data they should not be able to see.

Technologies: [github.com/rancher/rancher (Go)](https://junglewise.ai/threats/technologies/github-com-rancher-rancher), [Suse Rancher](https://junglewise.ai/threats/technologies/rancher), [Suse Rancher Manager](https://junglewise.ai/threats/technologies/rancher-manager). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Suse](https://junglewise.ai/threats/vendors/suse).

## Quick answers

**Is CVE-2026-41053 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41053 being exploited in the wild.

**How severe is CVE-2026-41053?** High severity, with a CVSS score of 8.8, published 30 June 2026.

**Which products and versions are affected?** github.com/rancher/rancher (Go) SEMVER:introduced=0,fixed=0.0.0-20260519172014-d0c047bbc6d2, SEMVER:introduced=2.14.0,fixed=2.14.2; Suse Rancher >=2.13.0, <2.13.6; >=2.14.0, <2.14.2; Suse Rancher Manager >= 2.14.0, < 2.14.2; >= 2.13.0, < 2.13.6.

**Is there a fix for CVE-2026-41053?** Yes. github.com/rancher/rancher (Go): upgrade to 0.0.0-20260519172014-d0c047bbc6d2, 2.14.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41053 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-41053?** Check whether you run github.com/rancher/rancher (Go), Suse Rancher or Suse Rancher Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/rancher/rancher (Go): upgrade to 0.0.0-20260519172014-d0c047bbc6d2, 2.14.2 or later

  ```sh
  go get github.com/rancher/rancher@v2.14.2
  ```


## Technical details

An incorrect implementation of the authentication algorithm (CWE-303) exists in Rancher's GitHub App authentication provider. When evaluating group principals, the logic incorrectly iterates over all teams in the associated GitHub organization instead of the user-specific membership list due to improper handling of cached data. An attacker with a valid GitHub account and membership in at least one team can bypass Role-Based Access Control (RBAC) and login allowlists. This allows the attacker to inherit permissions from any other team in the organization that has been mapped to Rancher roles. Patches are available in versions 2.14.2 and 2.13.6.

## Affected products

- SUSE Rancher Manager >= 2.14.0, < 2.14.2; >= 2.13.0, < 2.13.6

## Identifiers

- CVE-2026-41053
- GHSA-4j6x-2764-m8gh
- GO-2026-5869

## Timeline

- 2026-05-27: disclosed
- 2026-06-30: advisory: NVD publication date
- 2026-07-01: advisory: GitHub Advisory reviewed

## References

- [https://api.github.com/users/Yuremin](https://api.github.com/users/Yuremin)
- [https://github.com/Yuremin](https://github.com/Yuremin)
- [https://api.github.com/users/Yuremin/gists%7B/gist_id%7D](https://api.github.com/users/Yuremin/gists%7B/gist_id%7D)
- [https://api.github.com/users/Yuremin/repos](https://api.github.com/users/Yuremin/repos)
- [https://avatars.githubusercontent.com/u/49851084?v=4](https://avatars.githubusercontent.com/u/49851084?v=4)
- [https://api.github.com/users/Yuremin/events%7B/privacy%7D](https://api.github.com/users/Yuremin/events%7B/privacy%7D)

## Related threats

- [SUSE Rancher Manager credential leak in meta proxy](https://junglewise.ai/threats/cve-2026-88811-missing-filtering-in-the-suse-rancher-manager-meta-proxy-could)
- [SUSE Rancher privilege escalation in GlobalRole RBAC](https://junglewise.ai/threats/cve-2026-88810-a-privilege-escalation-issue-was-discovered-in-rancher-manager-s)
- [SUSE Rancher Manager meta proxy allowlist bypass leading to SSRF](https://junglewise.ai/threats/cve-2026-88809-a-security-vulnerability-exists-in-the-suse-rancher-manager-meta)
- [SUSE Rancher Manager authorization bypass in local cluster shell](https://junglewise.ai/threats/cve-2026-104623-a-security-vulnerability-exists-in-the-authorization-handling)
- [Rancher privilege escalation via project name collision](https://junglewise.ai/threats/cve-2024-22031-rancher-users-who-can-create-projects-can-gain-access-to)